Would This Cyber Scam Fool You?

The average Internet scammer isn’t above utilizing dirty tricks to claim their ill-gotten prizes from their victims. A recent scam shows just how dirty these tricks can be. Unfortunately, it also demonstrates how ill-prepared many people are to handle them.

To preface this scam, we need to appreciate the range of another Internet vice: pornography. Explicit adult material makes up a full 30 percent of the content on the Internet, and pornographic websites see more traffic than the combined totals for Amazon, Twitter, and Netflix. To cut to the point: there’s a lot of porn out there, which may be why this specific scam has been somewhat successful.

How this Scam Works
Most scams are run in order to steal money from a victim, and this one is no exception. Also like many others, this scam features some extortion: "give us what we want, or we’ll share your dirty little secret with the world."

In this scenario, the secret is particularly dirty, according to the email that begins the scam (which starts, by the way, by identifying one of the target’s passwords in the subject line):

“You don’t know me and you’re thinking why you received this email, right?

Well, I actually placed a malware on the porn website and guess what, you visited this web site to have fun (you know what I mean). While you were watching the video, your web browser acted as a RDP (Remote Desktop) and a keylogger which provided me access to your display screen and webcam. Right after that, my software gathered all your contacts from your Messenger, Facebook account, and email account.

What exactly did I do?

I made a split-screen video. First part recorded the video you were viewing (you’ve got a fine taste haha), and next part recorded your webcam (Yep! It’s you doing nasty things!).

What should you do?

Well, I believe, $1400 is a fair price for our little secret. You’ll make the payment via Bitcoin to the below address (if you don’t know this, search “how to buy bitcoin” in Google).”

At this point, the email provides the user with the means to deposit a ransom of $1400 worth of Bitcoin. The email even advises them to copy and paste the required alphanumeric code so there are no mistakes made. The email then ends with this ultimatum:

“Important:

You have 24 hours in order to make the payment. (I have an unique pixel within this email message, and right now I know that you have read this email). If I don’t get the payment, I will send your video to all of your contacts including relatives, coworkers, and so forth. Nonetheless, if I do get paid, I will erase the video immidiately [sic]. If you want evidence, reply with “Yes!” and I will send your video recording to your 5 friends. This is a non-negotiable offer, so don’t waste my time and yours by replying to this email.”

Obviously, this is not the kind of news that anyone wants to hear. A few versions of this threat have been circulating, but all share the same essential message: pay what we ask, or your private activities will be made very public.

Don't Panic… Yet
You need to realize that this threat is an empty one, as gut-wrenching as it is. The biggest giveaway? The fact that the passwords this threat shared come from a decade-or-so-old hack of some database. Ideally, you would be able to see the password and think, “Wow, it’s been a while since I used that!” However, there are still lessons to be learned from these scam attempts, especially considering how successful this one has been so far.

By collecting ransoms of $1400, this scam racked up a total of over a quarter of a million dollars in just over a month. This reveals a few things: that people are not changing their passwords nearly often enough, and that threats like these are only going to continue, and may soon become more than just empty threats. Ponder how many of your devices have a front-facing camera - there’s a better chance than not that some cybercriminal has some footage of you from some point in time. Whether or not you’re doing anything potentially embarrassing in it… that’s another story.

Protecting Yourself from these Scams
When avoiding scams like these, the name of the game is proactivity. This is especially true whenever your passwords are a part of the equation. Proper password management is not something to procrastinate on. Yes, it can be irritating to remember so many different passwords, and to keep changing them just when you’ve remembered them, but there are password managers and other solutions to make it easier for you without short-changing your security.

Speaking of your security, you may want to take a few seconds to make sure that your webcam is covered up if you don’t need to use it. Whether or not you’re going to do anything private, you’ll be safe from peering eyes.

For more help protecting yourself from these scams and otherwise optimizing your organization's use of the IT at its disposal, reach out to Macro Systems at 703-359-9211.